From: Lowder, Jason P. (CYD) (FBI) <Jason.Lowder@ic.fbi.gov> 


Sent: Saturday, August 6, 2016 10:24 AM 

To: Yearwood, Ronald J. (CYD) (FBI) <Ronald. Yearwood@ic.fbi.gov> 

Subject: Fwd: scheduled DDoS-attack on hillaryclinton.com 

Ron, 

I don't know if MCCU forwarded this to you but status on DDOS. I didn't remember to forward yesterday. 
Sorry. 

A/UC Jason Lowder 

ECOU TI 

FBI Cyber Division 

y> 


-------- Original message -------- 

From: "Hays, Rodney J. (WF) (FBD" <Rodney.Hays@ic.fbi.gov> 

Date: 08/05/2016 6:03 PM (GMT-05:00) 

To: "Cocklin, Nathan A. (CYD) (FBI)" <Nathan.Cocklin@ic.fbi.gov>, "Cheeks I, James E. (CYD) (FBI)" 
<James.Cheeks@ic.fbi.gov>, "Burnham, Michael (CYD) (FBI)" <Michael.Burnham@ic.fbi.gov>, "Pierrot, 
Ryan J. (CYD) (FBI)" <Ryan.Pierrot@ic.fbi.gov>, "Hubiak, Joshua J. (PH) (FBI)" 
<Joshua.Hubiak@ic.fbi.gov>, "Hammell, Delynn B. (SF) (FBI)" <Delynn.Hammell@ic.fbi.gov>, "Mularski, J 
K. (PG) FBD)" <J .Mularski@ic.fbi.gov> 

Cc: "Etienne, Hadley (WF) (FBD" <Hadley.Etienne@ic.fbi.gov>, "Drake, Matthew W. (WF) (FBI)" 
<Matthew.Drake@ic.fbi.gov>, "Frasch, Jennifer J. (WF) (FBI)" <Jennifer.Frasch@ic.fbi.gov>, "Brogan, Ryan 
G. (CYD) (FBI)" <Ryan.Brogan@ic.fbi.gov>, "Lowder, Jason P. (CYD) (FBD" <Jason. Lowder@ic.fbi.gov>, 
"Brelsford, Eric T. (CG) (FBD" <Eric.Brelsford@ic.fbi.gov>, "Hemmersmeier, Daniel J. (CG) FBD" 
<Daniel. Hemmersmeier@ic.fbi.gov> 

Subject: RE: scheduled DDoS-attack on hillaryclinton.com 


Quick update. 


Just received the email header from the DC attorney. At first glance, it contains the private address 10 block IPs along 
with other proxy/anonymous markings, attributes, etc. 


I then spoke to him by phone and told him that the same type of threat was boiler plate and had been seen in other 
matters we had reviewed. He did not know who (FBI office) the campaign would rather talk to if there is an issue with 
the threat “promised” for Monday. | told him | was available by phone this weekend if something came up. 


He had nothing else to offer or request from us. | don’t think this is something they are going to continue to push with 
us unless there is an actual incident next week. 


Rodney 


SA Rodney |. Hays 
FBI Washington, D.C. Field Office 
Desk - (703) 686-6271 


Cell SNS} 7 034. 
rodney. hays@ic.fbi.gov 


FBI-DWS-12-0024358 
SCO-011839 


No. 1:21-cr-00582-CRC (D.D.C.) DX-124 0001 


From: Cocklin, Nathan A. (CYD) (FBI) 

Sent: Thursday, August 04, 2016 10:05 AM 

To: Hays, Rodney J. (WF) (FBI); Cheeks II, James E. (CYD) (FBI); Burnham, Michael (CYD) (FBI); Pierrot, Ryan J. (CYD) 
(FBI); Hubiak, Joshua J. (PH) (FBI); Hammell, Delynn B. (SF) (FBI); Mularski, J K. (PG) (FBI) 

Cc: Etienne, Hadley (WF) (FBI); Drake, Matthew W. (WF) (FBI); Frasch, Jennifer J. (WF) (FBI); Brogan, Ryan G. (CYD) 
(FBI); Lowder, Jason P. (CYD) (FBI); Brelsford, Eric T. (CG) (FBI); Hemmersmeier, Daniel J. (CG) (FBI) 

Subject: RE: scheduled DDoS-attack on hillaryclinton.com 


Rodney - Thanks for the update. 


FBI Chicago has had an open investigation on Lizard Squad for the past year. | am looping them in for coordination and 
deconfliction. They will also be invited to the 2 pm call today. 


Thanks, 
Nathan 


Nathan A. Cocklin 
Supervisory Special Agent 
Cyber Division - Cyber Operations Section V 
Major Cyber Crimes Unit 
703-633-6079 (D) 
PNG) -9 185 (C) 


From: Hays, Rodney J. (WF) (FBI) 

Sent: Wednesday, August 03, 2016 3:28 PM 

To: Cheeks II, James E. (CYD) (FBI); Cocklin, Nathan A. (CYD) (FBI); Burnham, Michael (CYD) (FBI); Pierrot, Ryan J. 
(CYD) (FBI); Hubiak, Joshua J. (PH) (FBI); Hammell, Delynn B. (SF) (FBI); Mularski, J K. (PG) (FBI) 

Cc: Etienne, Hadley (WF) (FBI); Drake, Matthew W. (WF) (FBI); Frasch, Jennifer J. (WF) (FBI); Brogan, Ryan G. (CYD) 
(FBI); Lowder, Jason P. (CYD) (FBI) 

Subject: RE: scheduled DDoS-attack on hillaryclinton.com 


Just got off the phone with the attorney, Michael Sussman (Perkins Coie). | asked him to send me the email header to 
review. He sent the request over to the HRC campaign. He does not know yet if he will be the point of contact for this 
or if someone over at the campaign will start contacting me directly today. He is headed to a meeting at the DNC now. | 
asked him for an update on a point of contact or any new information later in the day. 


He is not sure who handles the campaign’s IT security or who handles DDOS mitigation for the campaign. He did say the 
campaign is not going to pay the ransom. The bitcoin address has been checked and is set up. There are no transactions 
involved with it at this time so it has no lead value as of now. The 22 BTC demand equates to about $12,386.00 based 
on the bitcoin exchange rate today. 


WFO is available for a call during the 10:30 to 3:00 window if Cyber HQ wants to set up a conference for tomorrow. 


Rodney 


SA Rodney J. Hays 
FBI Washington, D.C. Field Office 
Desk - (703) 686-6271 


Cell - ES 7034 
rodney. hays@ic.fbi.gov 


FBI-DWS-12-0024359 
$CO-011840 


No. 1:21-cr-00582-CRC (D.D.C.) DX-124 0002 


From: Cheeks II, James E. (CYD) (FBI) 

Sent: Wednesday, August 03, 2016 12:43 PM 

To: Cocklin, Nathan A. (CYD) (FBI); Hays, Rodney J. (WF) (FBI); Burnham, Michael (CYD) (FBI); Pierrot, Ryan J. (CYD) 
(FBI); Hubiak, Joshua J. (PH) (FBI); Hammell, Delynn B. (SF) (FBI); Mularski, J K. (PG) (FBI) 

Cc: Etienne, Hadley (WF) (FBI); Drake, Matthew W. (WF) (FBI); Frasch, Jennifer J. (WF) (FBI); Brogan, Ryan G. (CYD) 
(FBI); Lowder, Jason P. (CYD) (FBI) 

Subject: RE: scheduled DDoS-attack on hillaryclinton.com 


Rodney, 


Good afternoon. | spoke to SSA Ryan Pierrot at MCCU, we are both available tomorrow from 10:30am — 3pm for a 
conference call (if this works for the rest of the group). | include SA Hubiak and Hammell as well as SSA Mularski from 
PG. All three of these offices are working the NSB side of this. 


r/ 
Cheeks 


SSA James E. Cheeks II 
FBI Cyber Division 
Office: 703-633-6346 


Cell: RNSED-3561 


From: Cocklin, Nathan A. (CYD) (FBI) 

Sent: Wednesday, August 03, 2016 12:31 PM 

To: Hays, Rodney J. (WF) (FBI); Cheeks II, James E. (CYD) (FBI); Burnham, Michael (CYD) (FBI) 

Cc: Etienne, Hadley (WF) (FBI); Drake, Matthew W. (WF) (FBI); Frasch, Jennifer J. (WF) (FBI); Brogan, Ryan G. (CYD) 
(FBI) 

Subject: RE: scheduled DDoS-attack on hillaryclinton.com 


Adding SSA Ryan Brogan Hactivist TFC PM. 


-------- Original message -------- 

From: "Hays, Rodney J. (WF) (FBD)" <Rodney.Hays@ic.fbi.gov> 

Date: 08/03/2016 12:25 PM (GMT-05:00) 

To: "Cheeks 11, James E. (CYD) (FBD" <James.Cheeks@ic.fbi.gov>, "Burnham, Michael (CY D) (FBI)" 
<Michael.Burnham@ic.fbi.gov> 

Cc: "Etienne, Hadley (WF) (FBD" <Hadlev Etienne@ic fbi. gov>, "Cocklin, Nathan A. (CYD) (FBD" 
<Nathan.Cocklin@ic.fbi.gov>, "Drake, Matthew W. (WF) (FBD" <Matthew.Drake@ic.fbi.gov>, "Frasch, 


Jennifer J. (WF) (FBI)" <Jennifer, Frasch@ic. fbi. gov> 
Subject: FW: scheduled DDoS-attack on hillaryclinton.com 


James/Michael, 
See below. | was advised by SSA Frasch that she had provided you with the captioned info. She advised that you would 


start coordination with MCCU. Let me know if you have anything to report yet. | can give an update later after | speak 
to the Clinton Campaign attorney at 2:30 today. Perhaps we (WFO/CyberHQ) can conference sometime tomorrow. 


FBI-DWS-12-0024360 
SCO-011841 


No. 1:21-cr-00582-CRC (D.D.C.) DX-124 0003 


All of these matters touch on both the NSB and Criminal side so let me know who the HQ point of contact on this will be 
going forward. 


Thanks, 


Rodney 


SA Rodney J. Hays 
FBI Washington, D.C. Field Office 
Desk - (703) 686-6271 


Cell - SENS 7084 
rodney. hays@ic.fbi.gov 


From: Sussmann, Michael A. (Perkins Coie) [mailto: MSussmann@perkinscoie.com] 
Sent: Wednesday, August 03, 2016 11:57 AM 

To: Frasch, Jennifer J. (WF) (FBI); Hays, Rodney J. (WF) (FBI) 

Cc: Garrett, Lafayette M. (WF) (FBI); Hawkins, E. A. (WF) (FBI) 

Subject: Re: scheduled DDoS-attack on hillaryclinton.com 


Thank you very much. 


Michael Sussmann | Perkins Coie LLP 
P: 202.654.6333 
www.perkinscoie.com/msussmann 


From: "Frasch, Jennifer J. (WF) (FBI)" <Jennifer.Frasch@ic.tbi.gov> 

Date: Wednesday, August 3, 2016 at 11:50 AM 

To: Michael <msussmann@perkinscoie.com>, "Hays, Rodney J. (WF) (FBI)" <Rodney.Hays @ic.fbi.gov> 
Cc: "Garrett, Lafayette M. (WF) (FBI)" <Lafayette.Garrett@ic.fbi.gov>, "Hawkins, E. A. (WF) (FBI)" 
<Adrian. Hawkins @ic.fbi.gov> 

Subject: Re: scheduled DDoS-attack on hillaryclinton.com 


Good morning Mr. Sussmann, 

Thank you for providing us the information. Given the cyber criminal nature of anticipated activity, I've 
included SA Rodney Hays from WFO's cyber criminal squad for visibility and appropriate coordination within 
FBI. 


SSA Jennifer J. Frasch, CY-3 

Washington Field Office, NVRA 
Computer Intrusion Program Coordinator 
703-686-6710 (0) 

EE-2931 (c) 


From: Sussmann, Michael A. (Perkins Coie) <MSussmann@perkinscoie.com> 
Sent: Tuesday, August 2, 2016 9:58 PM 

To: Hawkins, E. A. (WF) (FBI) 

Cc: Frasch, Jennifer J. (WF) (FBI); Garrett, Lafayette M. (WF) (FBI) 

Subject: FW: scheduled DDoS-attack on hillaryclinton.com 


FBI-DWS-12-0024361 
SCO-011842 


No. 1:21-cr-00582-CRC (D.D.C.) DX-124 0004 


Adrian, 


The Clinton Campaign received this extortionate email yesterday, threatening a DDOS attack beginning on 
Monday that “WILL affect your candidate’s presidential chances,” unless ransom is paid before then. 


The Campaign is taking steps to prepare, but if the threat is real, there is significant risk. Unfortunately, 
the Campaign has no further information for you on this, but if you have or develop information 
concerning this threat, please let me know and I can set up a call with them. 


Thank you, 


Michael 


Michael Sussmann | Perkins Coie LLP 
P: 202.654.6333 
www.perkinscoie.com/msussmann 


---------- Forwarded message ---------- 

From: Lizard Squad <lizardsquad@lizardsquad.org> 
Date: Mon, Aug 1, 2016 at 9:02 PM 

Subject: scheduled DDoS-attack on hillaryclinton.com 
To: domains@hillaryclinton.com 


FORWARD THIS MAIL TO A PERSON WHO IS ABLE TO MAKE DECISIONS! 

THIS IS NOT A MASS SEND MESSAGE 

Dear Sir/Madam at Hillary Clinton's Presidential Campaign 

We are Lizard Squad, https: //en.wikipedia.org/wiki/Lizard_Squad 

Most importantly, we have launched one of the largest DDoS attacks in history and one of the largest 
DDoS attacks ever. Search for "Lizard Squad DDoS" 

Hillary CLinton's official website will be DDoS-ed starting Monday (August 8th, 2016) if you don't pay 
protection fee - exactly 22 Bitcoins to this Bitcoin wallet 

17ead9Cx7iDCJZ5xFAyYAATCBgXqZLONEKB 

If you don't pay by Monday, attack will start, all your online services will go down permanently, price to 
stop the attack will increase to 44 BTC and will go up 22 BTC for every day of attack. 

This attack WILL affect your candidate's presidential chances, your website will be down for days or 
weeks, you will lose potential voters and you will also lose your Google rankings. 

This is not a joke. 

Our stresser tool is unique and our attacks are extremely powerful - 500Gbps with a peak of over 1Tbps. 
You can buy bitcoins here: 

https://localbitcoins.com 

or at any large Bitcoin brokers 

https://www.buybitcoinworldwide.com/en/us 

or simply google "how to buy bitcoin" for instructions 

Contacting police or other authorities if you decide to do it or not will be a waste of time as we are 
completely anonymous. 

Do not reply, we will not read. Pay and we will know it's you (this unique wallet was set just for you) AND 
YOU WILL NEVER HEAR FROM US AGAIN! 

Bitcoin is anonymous, nobody will ever know you cooperated. 

ACT NOW BEFORE IT IS TOO LATE! 


FBI-DWS-12-0024362 
$CO-011843 


No. 1:21-cr-00582-CRC (D.D.C.) DX-124 0005 


NOTICE: This communication may contain privileged or other confidential information. If you have received it in error, please advise the sender by reply email and 
imrnediately delete the message and any attachments without copying or disclosing the contents. Thank you. 


NOTICE: This communication may contain privileged or other confidential information. If you have received it in error, please advise the sender by reply email and 
immediately delete the message and any attachments without copying or disclosing the contents. Thank you. 


FBI-DWS-12-0024363 
SCO-011844 


No. 1:21-cr-00582-CRC (D.D.C.) DX-124_ 0006 


